Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

471–480 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#471

Post by yebyen »

skolsuper wrote: post #383
mikesickler wrote: post #339

Earlier quoted context omitted.

Of course it could have! No API is foolproof

I think the joke is that both Github and Twitter are famous for being built on Rails (although Twitter just-as-famously required a move off of Rails in order to scale)

There was a great keynote about this at this year's RailsConf

The argument was essentially that if Twitter had instead chosen a language that was more natively inclined toward scalability, they would have necessarily hired 10x as many engineers and they would not have succeeded at building the product that people use to tell each other what bar they are at, simply, which ultimately was the braindead simple thing (that you can probably scale just fine in any language) which drove their success... it wasn't any great technological feat that made Twitter successful, it was pretty much just the "Bro" app that people loved.

(The talk was called "Rails Doesn't Scale" and will be available soon, but RailsConf2018 evidently hasn't posted any of the videos yet.)

Re: Twitter urges users to change passwords after computer 'glitch'

#472

Post by unilynx »

Can't we reduce the risk of these accidental disclosures by using public/private key encryption? Ie:

- server publishes a public key on a fixed url

- your JS framework (react/angular/form handling/whatever) is modified to, whenever you query the value of a input[type=password], to return a value encrypted with the private key. (as close to the reading of the field as possible, except for eg. 'repeat password' handling)

- your serverside code decrypt the password as close to their 'VerifyPassword' and 'UpdatePassord' implementation as possible. and fail if they receive an unencrypted password.

This would make it very hard for intermediate steps (middleware, RPC/REST/JSON decoding) to accidentally spill the password, even if they fully log the traffic, and is something frameworks should be able to help you enforce.

Re: Twitter urges users to change passwords after computer 'glitch'

#473

Post by ealhad »

lorenzhs wrote: post #414
ealhad wrote: post #173

Earlier quoted context omitted.

Time for me to advertise my personal setup again! I use KeePassXC [1] with Syncthing [2] to synchronize my passwords between machines. No third-party! [1] : https://keepassxc.org/ [2] : https://syncthing.net/

Does anyone have a recommendation for a good keepass client for iOS? Is MiniKeePass still the best option? I've been wanting to switch to KeePassXC + something for iOS for a while but I'm not sure what the best way to go is.

On KeePassXC’s website [1], they recommend MiniKeePass [2] and KeePass Touch[3]. I don’t own any iOS device, so I have tried neither.

[1] https://keepassxc.org/docs/#faq-platform-mobile

[2] https://itunes.apple.com/us/app/minikeepass/id451661808?mt=8

[3] https://itunes.apple.com/us/app/keepass-touch/id966759076?mt...

Re: Twitter urges users to change passwords after computer 'glitch'

#474

Post by ealhad »

nl wrote: post #446
lorenzhs wrote: post #414

Earlier quoted context omitted.

Does anyone have a recommendation for a good keepass client for iOS? Is MiniKeePass still the best option? I've been wanting to switch to KeePassXC + something for iOS for a while but I'm not sure what the best way to go is.

I use MiniKeePass. Don’t love it, but don’t know a better option.

As I pointed in my reply, you could also try KeePass Touch.

Re: Twitter urges users to change passwords after computer 'glitch'

#475

Post by tbodt »

overlordalex wrote: post #398
omarforgotpwd wrote: post #257

Earlier quoted context omitted.

Let's say you log requests and the POST body parameters that are sent along with them. Oops, forgot to explicitly blank out and fields known to contain passwords. Now they're saved in cleartext in the logs every time the user logs in.

We made this mistake - the trick is determining what fields are sensitive, what are sensitive enough that they should be censored but included in the log, and the rest of the crud. It turns out that this is non-trivial - when censoring how do you indicate that something was changed, while keeping the output to a minimum? blank/"null" was rejected because it would mask other problems, and " * THIS FIELD HAS BEEN REDAC…

I'd replace redacted fields with [redacted], or maybe U+2588

Re: Twitter urges users to change passwords after computer 'glitch'

#476

Post by sjapkee »

fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

>Due to a bug

>Write passwords to a log

Security level - Twitter.

Re: Twitter urges users to change passwords after computer 'glitch'

#477

Post by jazzdev »

lhnz wrote: post #444
sumeno wrote: post #427

Earlier quoted context omitted.

This only works if you automate every possible code path. If you're logging passwords during some obscure error in the login flow then an automated login very likely won't catch it.

True, but it is more effective than doing nothing.

But it's not a choice of doing this or nothing. It's a choice of doing this or something else. That something else may be a better use of your time.

Re: Twitter urges users to change passwords after computer 'glitch'

#478

Post by sundvor »

rudedogg wrote: post #376
sundvor wrote: post #151

Why should I change my "passwords"? I only have one entry for Twitch in my password manager. It's 2018, no sane person would reuse their passwords across multiple sites which can and do get hacked.

> It's 2018, no sane person would reuse their passwords across multiple sites which can and do get hacked. All of my family does this :(. I think it's really common outside of tech savvy people. I've tried pushing them to use a password manager on their phone, or writing them down so they can use multiple passwords, but they'd rather just use a single one. Years of bad advice didn't help either: - Never write your pa…

That's an awesome xkcd, thanks.

Re: Twitter urges users to change passwords after computer 'glitch'

#479

Post by anf »

alex_duf wrote: post #408
anf wrote: post #349

Earlier quoted context omitted.

Key logger + making a cron job that copies everything off your drive = 5 minutes of work? I hope you trust the folks you use this setup on...

Key logger + screen shots and you also get access to a 1 password account No matter what you do if the computer you are using isn't trustworthy you're losing.

Yeah, totally with you — don't trust devices you (or your employer) doesn't own. I'm borderline still where I trust my employer's devices with my personal passwords sometimes, but even that seems a bit iffy.

Re: Twitter urges users to change passwords after computer 'glitch'

#480

Post by ghazak »

scrollaway wrote: post #360
Rjevski wrote: post #295

Earlier quoted context omitted.

If the previous breaches are of any indication, it's that users don't give a shit - many major websites have leaked passwords ( https://haveibeenpwned.com/PwnedWebsites ) and they're still alive and kicking; for the ones that have gone down the drain (Yahoo!) it was more because the service itself faded into irrelevance. Based on that I'd say it would be pretty safe to disclose a breach and reset all passwords; if yo…

I suspect by "Losing active users", GP meant losing people who get confused or stuck throughout the password reset phase. Twitter is used by a lot of computer novices. Twitter did disclose this, through email and on first login. Anyone they'd lose because of the breach is long gone and I also think it's probably next to nobody.

Yes, I’m purely talking about losing people if they forced a password reset.
Post reply on HN